I don't know if it's possible to do this entirely from entries in the struts-config.xml file, but I do like the approach suggested by Kevin H. Le in This Article from Java World.
I'd modify his approach somewhat, though. He suggests creating a base Action class with the login check. Now that we have a pluggable Request Processor in Struts 1.3.8, I'd suggest adding another command to the chain that handles the login check. That way you don't have to modify Action classes at all. [ March 19, 2008: Message edited by: Merrill Higginson ]